SEO Keyword Research Tool

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:21 AM UTC
• Version: 1.0.1

Overview

This skill does what it says at a basic level: it fetches public YouTube captions and prepares them for AI summarization, with no hidden persistence or destructive behavior found.

Before installing, use an isolated environment and consider pinning youtube-transcript-api to a reviewed version. Treat fetched captions and generated summaries as local working data, and only save transcript or summary files when you explicitly want them persisted.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned and Unverified Third-Party Dependency

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1
Additional Location: SKILL.md:76-79
Vulnerability Type: Unbounded third-party dependency installation
Risk Level: Medium

Vulnerable Code

requirements.txt:1:

text

youtube-transcript-api>=0.6.0

SKILL.md:76-79:

text

**Requirements:**

pip install youtube-transcript-api

text

Technical Analysis

The project specifies only a minimum acceptable version of youtube-transcript-api and does not verify the downloaded artifact with a cryptographic hash. The installation command documented in SKILL.md is also entirely unpinned.

Consequently, package resolution may select any future version published under this package name. Such a version has not necessarily undergone the security review applied to the current project. Python packages can execute attacker-controlled code during installation or when imported by scripts/youtube_subtitles.py.

This is a supply-chain weakness rather than evidence that the currently named package is malicious.

Attack Path

1. An attacker compromises the dependency maintainer's package-index account, publishing infrastructure, or another relevant part of the distribution chain.
2. The attacker publishes a malicious version newer than the reviewed release.
3. A user installs dependencies from requirements.txt or follows the unpinned command in SKILL.md.
4. The package resolver selects and downloads the malicious release because no exact version or approved artifact hash is enforced.
5. Attacker-controlled code executes during package installation or when youtube_transcript_api is imported.
6. The code operates with the permissions of the user or automation account performing the installation or running the skill.

Impact Assessment

Successful exploitation could permit arbitrary code execution within the dependency installation or skill runtime context. The attacker could access files, credentials, environment var ...[truncated 292 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the open-ended version constraint with an exact, reviewed version:

   text

   youtube-transcript-api==REVIEWED_VERSION
   

2. Generate and validate cryptographic hashes for all dependency artifacts, and install with pip's --require-hashes option.
3. Maintain a reproducible lock file that includes transitive dependency versions and hashes.
4. Update SKILL.md so its installation command uses the locked requirements rather than installing the latest available release directly:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

5. Configure package installation to use an approved package index and prohibit unexpected alternate or extra indexes.
6. Review dependency updates before changing the pinned version, including provenance, release history, and vulnerability advisories.
7. Perform installation and execution in a least-privileged virtual environment or isolated container.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

There is a clear mismatch between the declared description and the actual code. The description promises a functional YouTube summarization capability, including subtitle fetching and summary generation, but the code does not implement any of these features. Instead, it is a minimal placeholder script with no external access, no parsing, no summarization, and no video-related behavior. This is a materially different primary purpose from what is declared.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description promises an end-to-end YouTube subtitle retrieval and summarization capability. The code only performs local text preprocessing: removing whitespace artifacts, chunking text, and formatting transcript text read from a file. There is no YouTube access, no network retrieval, no subtitle extraction, and no summarization logic. This is a material description-behavior mismatch because the primary advertised capabilities are absent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The code accurately supports subtitle retrieval from public YouTube videos and multilingual subtitle selection/listing. However, it does not generate summaries, extract key points, or provide configurable summary lengths. Its actual function is a subtitle fetcher, not a subtitle fetcher plus summarizer. This is a material description-to-behavior mismatch because summarization is presented as a core purpose.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence

Finding

The skill describes behavior that requires network access and likely local file access, but it does not declare any explicit tool scope or permissions. Missing scope declarations weaken sandboxing and review controls because the runtime may permit broader capability use than users or operators expect.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

An overly broad trigger can cause the skill to activate for generic summarization requests that are unrelated to YouTube. This creates a security and safety boundary problem because a network-enabled or file-capable skill may be invoked in contexts where the user did not intend external fetching or local output behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The skill advertises export behavior and local file output but does not warn users in the markdown description that data may be written to disk. This can surprise users, create privacy issues, and increase the chance of unintended persistence of potentially sensitive derived content.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency is specified with a lower bound only (youtube-transcript-api>=0.6.0), which allows future unreviewed versions to be installed. This creates supply-chain and stability risk because a later release could introduce breaking changes or a malicious/compromised package version without any change to this skill.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

youtube-transcript-api>=0.6.0

Static analysis

No suspicious patterns detected.